Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 16:47
General
- Target 2026-04-24_0a5b6dba7f7294e77253c69bc1960ad6_elex_goldeneye_wannacry.exe
- Size 204KB
- Sample260424-vapp7aex3w
- SHA256 3f3f3cf43e0edeb618236523714f3245ed34b0743bcbbeaf457d4dc4488a00c4
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureAuto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_0a5b6dba7f7294e77253c69bc1960ad6_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_0a5b6dba7f7294e77253c69bc1960ad6_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B273D823-119D-49e8-9482-52BFFC43697F}.exeC:\Windows\{B273D823-119D-49e8-9482-52BFFC43697F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11D7C1D6-9831-4393-9E88-3C5CF138CF88}.exeC:\Windows\{11D7C1D6-9831-4393-9E88-3C5CF138CF88}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC5F2BFD-C312-41fe-B6B3-0815D1F4B99F}.exeC:\Windows\{FC5F2BFD-C312-41fe-B6B3-0815D1F4B99F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6301738-A69D-4637-A8C2-DD401396CBB5}.exeC:\Windows\{C6301738-A69D-4637-A8C2-DD401396CBB5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC98E317-8857-47f4-B15F-2709831E62A3}.exeC:\Windows\{CC98E317-8857-47f4-B15F-2709831E62A3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A080385-5FE9-49a2-96B5-C25B5C7978E9}.exeC:\Windows\{3A080385-5FE9-49a2-96B5-C25B5C7978E9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F90E01D2-5704-4db0-A7CA-0D123C5072F9}.exeC:\Windows\{F90E01D2-5704-4db0-A7CA-0D123C5072F9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD9EDA8B-4937-44f5-ACB6-A9E7869D3C3E}.exeC:\Windows\{FD9EDA8B-4937-44f5-ACB6-A9E7869D3C3E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38CE6197-C06C-4b20-96ED-EAEDC8095A34}.exeC:\Windows\{38CE6197-C06C-4b20-96ED-EAEDC8095A34}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD8F5A07-950C-4985-B1F4-118FB4959CB9}.exeC:\Windows\{BD8F5A07-950C-4985-B1F4-118FB4959CB9}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C57C6C7-8A7F-490d-8825-7DBE7301D408}.exeC:\Windows\{3C57C6C7-8A7F-490d-8825-7DBE7301D408}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD8F5~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38CE6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD9ED~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F90E0~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A080~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC98E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6301~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC5F2~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11D7C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B273D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{11D7C1D6-9831-4393-9E88-3C5CF138CF88}.exe
{38CE6197-C06C-4b20-96ED-EAEDC8095A34}.exe
{3A080385-5FE9-49a2-96B5-C25B5C7978E9}.exe
{3C57C6C7-8A7F-490d-8825-7DBE7301D408}.exe
{B273D823-119D-49e8-9482-52BFFC43697F}.exe
{BD8F5A07-950C-4985-B1F4-118FB4959CB9}.exe
{C6301738-A69D-4637-A8C2-DD401396CBB5}.exe
{CC98E317-8857-47f4-B15F-2709831E62A3}.exe
{F90E01D2-5704-4db0-A7CA-0D123C5072F9}.exe
{FC5F2BFD-C312-41fe-B6B3-0815D1F4B99F}.exe
{FD9EDA8B-4937-44f5-ACB6-A9E7869D3C3E}.exe